MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 020b4368059e1fd314ad7299d62c0c1373fe19d6f8fae574d804c7f20c914de5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 14

Intelligence 14 IOCs YARA 8 File information Comments

SHA256 hash:	020b4368059e1fd314ad7299d62c0c1373fe19d6f8fae574d804c7f20c914de5
SHA3-384 hash:	0d84e96f9550702b991488ca08d971c45552381ca80506244a845cd1ed44ba8e5d5c580bf8345177352557af335eaf07
SHA1 hash:	38ad01867721537ac8f71322887074e177afd2ef
MD5 hash:	dfc1887f8485f2a64ce7d2e16d9b2a40
humanhash:	lake-quiet-speaker-tennis
File name:	020b4368059e1fd314ad7299d62c0c1373fe19d6f8fae574d804c7f20c914de5
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	571'400 bytes
First seen:	2025-04-08 08:55:58 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:r4aQiKaxKU5VmuTkGVyKN/Um+RJgrjakGeji7RWbCpTPTkR:EaQi8U5PwGVym+uikG/FWuJPG
Threatray	1'332 similar samples on MalwareBazaar
TLSH	T173C4019D4A5AD403CE815B310BA1F3B967AE5EDCB8068227ABEC7DEFBC72D451C05181
TrID	69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.0% (.EXE) Win64 Executable (generic) (10522/11/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.2% (.EXE) Win32 Executable (generic) (4504/4/1) 1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika	pebin
dhash icon	6008e4e0f2e2e434 (12 x SnakeKeylogger, 6 x MassLogger, 5 x Formbook)
Reporter	adrian__luca
Tags:	exe MassLogger

Intelligence

File Origin

# of uploads :

# of downloads :

400

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

020b4368059e1fd314ad7299d62c0c1373fe19d6f8fae574d804c7f20c914de5

Verdict:

Malicious activity

Analysis date:

2025-04-08 16:57:44 UTC

Tags:

snake keylogger evasion stealer ims-api generic

Link:

https://app.any.run/tasks/32239354-d611-44a4-b516-b42b82d3ad2e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67f4e676a695a0cd1facb679

Tags:

virus micro msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Сreating synchronization primitives

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

DNS request

Connection attempt

Sending an HTTP GET request

Sending a custom TCP request

Reading critical registry keys

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

expired-cert invalid-signature obfuscated packed packed packer_detected signed vbnet

Link:

https://www.filescan.io/uploads/67f4e4ac6258a97207fbfe72/reports/16d989ce-b43e-4fe6-8058-54709d4502ad/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/020b4368059e1fd314ad7299d62c0c1373fe19d6f8fae574d804c7f20c914de5

Malware family:

Snake Keylogger

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/97873b14-acc7-4247-bf3e-9411833604a1

Result

Threat name:

MSIL Logger, MassLogger RAT

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1659238

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AntiVM3

Yara detected MassLogger RAT

Yara detected MSIL Logger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Score:

90%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/020b4368059e1fd314ad7299d62c0c1373fe19d6f8fae574d804c7f20c914de5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/020b4368059e1fd314ad7299d62c0c1373fe19d6f8fae574d804c7f20c914de5/

Threat name:

ByteCode-MSIL.Spyware.Negasteal

Status:

Malicious

First seen:

2025-03-29 06:05:10 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=aifug2aftyp5gffnokm5mlamcnz74gow7d5ok5gyatd7ederjxsq._file

Verdict:

malicious

Label(s):

unc_loader_037

novastealer

MassLogger

80edf30940ba58cb632cb8b5bbed7f57df1dbc9c682ddc744b9ed44af3583db8

MassLogger

91c51905a2db1c29aa562d975beac52d8895342b0ccecb16aeb5d40daa97d2b6

MassLogger

efa962fc10045f83da36ea363c43aba7a8d5ff3ec0e3aaa4c6480c2578b8c4fa

MassLogger

+ 1'322 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

collection discovery spyware stealer

Link:

https://tria.ge/reports/250408-kv8npasmy8/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Verdict:

Malicious

Tags:

404keylogger

YARA:

n/a

Link:

https://app.threat.zone/submission/7d26d4b0-1209-4f87-8221-ebeca3acbe5c

Unpacked files

SH256 hash:

020b4368059e1fd314ad7299d62c0c1373fe19d6f8fae574d804c7f20c914de5

MD5 hash:

dfc1887f8485f2a64ce7d2e16d9b2a40

SHA1 hash:

38ad01867721537ac8f71322887074e177afd2ef

Link:

https://www.unpac.me/results/2d12abc8-6bef-47c1-a5c8-09e7807dcea2/

SH256 hash:

65f0880737b9a2dbf00faa12e37e679b8a1232237df736360fcc14e19e806cca

MD5 hash:

f22fece115e9c0f99bf3bff82d4fb834

SHA1 hash:

034e911420fad38712fb1200d9ff116af39a7cd4

Link:

https://www.unpac.me/results/2d12abc8-6bef-47c1-a5c8-09e7807dcea2/

SH256 hash:

e71521007e64e4011f80f4fb6f8fa07b05be52e8088ed18c0c19881a6391fb45

MD5 hash:

cb717a71e67908fb20e04b13ebec3aec

SHA1 hash:

2f2e5d402c19c4cbd98fdace3b9049fc1c42d565

Detections:

win_404keylogger_g1

win_masslogger_w0

MAL_Envrial_Jan18_1

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Link:

https://www.unpac.me/results/2d12abc8-6bef-47c1-a5c8-09e7807dcea2/

Parent samples :

7fc21521b3e61d0555c0c1adb947d9724c8ca61dc9caeef85a110ec46d3b2d5d
43d909c8afd4fe8010ca22bd90a2f65fd6e4275c36d103b91d0016f0c2988883
b8f79e1b5aecb07c83251141f0b128274c49697ebea217c83787abdf07fe00f2
e71521007e64e4011f80f4fb6f8fa07b05be52e8088ed18c0c19881a6391fb45
4be8e656872c1d27eeaec3bd38a9fd51648893ca4f8b79741b40e395ef91615e
35ebe17f33803f292a173b8652fdd9c69be8e6b89bc9897776e41c3a721b4211
efa962fc10045f83da36ea363c43aba7a8d5ff3ec0e3aaa4c6480c2578b8c4fa
1a98a78c6e63e52bd77d0a49c4738646e60c86e077174e523383509d2701f0e6
020b4368059e1fd314ad7299d62c0c1373fe19d6f8fae574d804c7f20c914de5
4dce97ef955a132177e7043fc0d11e35c3e1d03f833b3b30951d7b2ce6db735e

SH256 hash:

de8de18d44d3959f9fa953c79df2ff4ebeaf2d724a2255a3bafff02a2ffd9ee0

MD5 hash:

5f3d929d69ca4238a1245ca2318c50a1

SHA1 hash:

f9d3de6b418390fa95919220fbcebd5a0852f40b

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/2d12abc8-6bef-47c1-a5c8-09e7807dcea2/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.36

Link:

https://yomi.yoroi.company/submissions/020b4368059e1fd314ad7299d62c0c1373fe19d6f8fae574d804c7f20c914de5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTesla_DIFF_Common_Strings_01 Create hunting rule
Author:	schmidtsz
Description:	Identify partial Agent Tesla strings

Rule name:	INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438 Create hunting rule
Author:	ditekSHen
Description:	Detects executables signed with stolen, revoked or invalid certificates

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample